From 1ece2d912b2c0fa4e3428a46e83741ef7bfc0fcf Mon Sep 17 00:00:00 2001
From: Eric Evans <ericfevans@google.com>
Date: Wed, 1 Jul 2026 22:41:51 +0000
Subject: [PATCH] chore: Address Zizmor findings

---
 .github/workflows/build.yml | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0ed615da..0a83dbc5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,22 +1,24 @@
 name: Build
 on: [push, pull_request]
+permissions: {}
 jobs:
   build:
     runs-on: ubuntu-latest
-    env:	
+    env:
       DOTNET_NOLOGO: true
 
-    steps:	
-    - uses: actions/checkout@v7
-      with:	
-        submodules: true	
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      with:
+        submodules: true
+        persist-credentials: false
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
       with:
         dotnet-version: 8.0.x
 
-    - name: Build and test	
+    - name: Build and test
       run: |
         dotnet build
         dotnet test Google.Api.Generator.Tests --logger:"console;noprogress=true"